Last Call Review of draft-ietf-mboned-mtrace-v2-21
review-ietf-mboned-mtrace-v2-21-secdir-lc-piper-2017-11-30-00

Request Review of draft-ietf-mboned-mtrace-v2
Requested rev. no specific revision (document currently at 23)
Type Last Call Review
Team Security Area Directorate (secdir)
Deadline 2017-11-23
Requested 2017-11-09
Other Reviews Secdir Last Call review of - by Dan Harkins (diff)
Genart Last Call review of -21 by Meral Shirazipour (diff)
Genart Telechat review of -22 by Meral Shirazipour (diff)
Tsvart Telechat review of -22 by Brian Trammell (diff)
Review State Completed
Reviewer Derrell Piper
Review review-ietf-mboned-mtrace-v2-21-secdir-lc-piper-2017-11-30
Posted at https://mailarchive.ietf.org/arch/msg/secdir/xQXsqDCwlZrmHNgWzU8tIkIydyM
Reviewed rev. 21 (document currently at 23)
Review result Has Nits
Draft last updated 2017-11-30
Review completed: 2017-11-30

Review
review-ietf-mboned-mtrace-v2-21-secdir-lc-piper-2017-11-30

Reviewer: Derrell Piper
Review result: ready with nits

I have reviewed this document as part of the security directorate's ongoing
effort to review all IETF documents being processed by the IESG.  These
comments were written primarily for the benefit of the security area
directors.  Document editors and WG chairs should treat these comments just
like any other last call comments.

This document describes a new version of tracroute designed for multicast.  In
the multicast environment, traceroute functions in reverse with each router on
the path back towards the client adding diagnostic information along the way.
This information can be used to diagnose a variety of network problems,
including packet loss (congestion) and configuration problems (TTL).

The security considerations section discusses a variety of requirements and
suggestions for multicast routers and the protocol includes an ADMIN_PROHIB
flag which can be used at a border router to prevent multicast traceroute from
being able to probe network topology or to perform traffic analysis.

This appears to be a useful diagnostic utility and the obvious security
concerns seem to have been addressed.

nits:

page 33, section 9.3 and 9.4

MAY should be capitalized in these two sections.

Derrell